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Abstract 

Security trade-offs have previously been established for one-way bit commitment. We study this 
trade-off in two superselection settings. We show that for an 'abelian' superselection rule (exemplified 
by particle conservation) the standard trade-off between sealing and binding properties still holds. For 
the non-abelian case (exemplified by angular momentum conservation) the security trade-off can be 
more subtle, which we illustrate by showing that if the bit commitment is forced to be ancilla-free, an 
asymptotically secure quantum bit commitment is possible. 

PACS:03.670.-a, 03.67.Dd 



1 Introduction 

The question of whether the no-go result for quantum bit commitment Q, 0, remains valid in the 
presence of superselection rules has been addressed by several recent papers [4|, [5 1, [6]. The most general 
result is described in Ref. [5|, where the authors prove that secure quantum bit commitment is impossible 
even with general superselection rules. The authors of this paper distinguish security in the case of 'abelian' 
superselection rules (such as particle conservation) and 'nonabelian' superselection rules in which the im- 
posed symmetry is described by a non-abelian group. In both cases the authors prove the impossibility 
of establishing a secure bit-commitment protocol. In this paper we point out that the no-go result for the 
non-abelian case is fairly non-trivial; we show that if the cheating strategies are forced to be ancilla-free, 
an asymptotically secure protocol can be found. In contrast, for the abelian case (or in the absence of 
superselection rules) the 'no-ancilla' enforcement does not alter the security trade-offs for a one-way bit 
commitment (called a 'purification bit commitment' in Ref. 171). 



2 One-way Bit Commitment Protocol 

We repeat the definition in Ref. [7 1 of this important class of bit commitment (BC) protocols: 

Definition 1 (One- Way Bit Commitment Protocol, BC) / 7] In this protocol, Bob begins with no quantum 
state of his own, Alice begins with a two-part Hilbert space 7i p (g) Tit ("proof" and "token"). Alice chooses 
to commit to bit b. Alice prepares one of two orthogonal states \ Xb) in her total Hilbert space. In the 
commit phase, Alice transmits to Bob the state in Tit which we denote by p\,; in the unveiling phase, Alice 
transmits the state in 7i p to Bob; Bob determines the committed bit by projectively measuring the state using 
orthogonal projectors {Ho, H%, Hf a n}. 
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This is certainly not the most general quantum bit commitment protocol, which would permit more 
than one round of communication. The security uade-offs of one-way BC protocols have been described as 
follows, see Ref. [7]. Two scenarios are considered: 1) Alice is honest, but Bob tries to cheat by learning 
the bit in the commit phase. 2) Bob is honest, but Alice tries to cheat by changing her committed bit after 
the commit phase. In case 1), Bob is trying to make his "information gain" G(S B ) nonzero, defined as the 
difference between his probability of estimating Alice's commitment correctly in the commit phase when 
he employs cheating strategy S B , and when he is honest, 

G(S B ) = P E (S B ) - 1/2. (1) 

In case 2), Alice is trying to make her "control" C(S A ) nonzero, defined as the difference between her 
probability of unveiling whatever bit she desires when she implements S A , and when she is honest, 

C(S A ) = Pu(S A ) - 1/2. (2) 

Then, the security of any given protocol can be characterized by the maximum of these two quantities: 

G max = maxG(5 B ), 

c max = maxC(5 A ). (3) 

s A 

For one-way bit commitment protocols it has been established f7) that 

G max = il)(po,Pi) = ~tr| P0 - Pl |. (4) 
C max = \f{ P0 , Pi ) = itr|VpVpTI> (5) 

where .) is the fidelity function and D(., .) is the trace-distance function. Notably, the cheating strate- 
gies that achieve these optima do not make use of ancillas: Alice's cheating strategy is the creation of a 
b— independent state potentially followed by unitary rotation, whereas Bob's cheating strategy is a complete 
von Neumann measurement projecting in the eigenbasis of po — pi, achieving the trace distance. Let us 
define what we mean by an ancilla-free bit commitment: 

Definition 2 (Ancilla-Free One- Way Bit Commitment Protocol, AFBC) A one-way bit commitment pro- 
tocol in which we restrict the cheating strategies to ones which have no access to additional quantum sys- 
tems, i.e. ancillas. Thus cheating strategies consist of local unitary transformations and complete von 
Neumann measurements. 



3 One-way Bit Commitment with Superselection Rules 

To proceed with this analysis, we must stipulate how the one-way bit commitment protocol is constrained 
by superselection rules [8]. 1 We also refer to [ 10 1 for a detailed description of how superselection rules 
and their associated symmetry groups impose constraints. 

'The distinction between selection rules and superselection rules is not always very clear. At an informal level one may think 
that superselection rules are due to fundamental laws in nature and thus never to be violated, whereas selection rules are of a more 
relative nature, valid for the particular energy scales at hand, or due to technological/practical constraints. A different and more 
precise definition was given in the original paper |9|. There superselection rules are defined as selection rules, i.e. a dynamical 
conservation laws, with the additional restriction that off-diagonal matrix elements in the conserved quantum number basis cannot 
be distinguished by measurement. These definitions of selection and superselection rules seem to leave open the possibility for an 
initial condition that is a superposition of different quantum numbers. In this section we specify in detail what we mean by bit 
commitment constrained by the superselection rules. 
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We assume that Alice and Bob's actions have to obey a local superselection rule which can be given 
by a Hermitian operator Ka and Kb- We will discuss two examples here: 1) K A /b is the local particle 
number Na/b- 2) Ka/b i s a local total angular momentum operator J\i B ; this is a 'nonabelian' case (the 
symmetry group is that of space rotations). 

Here then are the restrictions that we will require for the one-way bit commitment. These restrictions 
include the possible cheating strategies of the parties: 

1. The states in the token+proof Hilbert space in Alice's lab are eigenvectors of Ka with the same 
eigenvalue, say k. Thus, Ka\ Xo) = k\ Xo) an d Ka\ Xi) = k\ Xl)- If Alice cheats and she chooses to 
create other states, then these should also be eigenstates of Ka- 2 

2. Any action that Alice performs before the commit phase must involve unitary transformations that 
leave the eigenvalue k unchanged, i.e., [U, Ka] = 0. 

3. After the commit phase, any unitaries performed by Alice must satisfy [U, Ka] = 0. Likewise for 
Bob when he is given the token: [U, Kb] = 0. 

4. Any measurements that Bob performs must respect the superselection rule. Thus, in the commit phase 
(when Bob might wish to cheat) any measurement projector II of Bob on the token space must satisfy 
[II, Kb] = 0. In the unveiling phase, the same must be true for the joint token+proof Hilbert space in 
Bob's possesion: [II, Kb] = 0. 

If the cheating strategy is not required to be ancilla-free, Bob could create a state of definite quantum 
number ks in his lab before he receives the token. After he has received the token, he should respect 
the conservation rule on his total token+ancilla space, but the ancilla may still help him to do a better 
measurement. 

Let us use the following notation: since a one-way BC protocol is completely specified once the orthog- 
onal pair | Xo,i) is agreed upon, we will refer to this protocol as BC(| Xo,i})- If the protocol has the above 
superselection rule restrictions imposed involving operator K, we will refer to this protocol as BCk(| Xo,i))- 
If the protocol is forced to be ancilla-free we write AFBCk(| xo,i))- 



4 Our results 

We find that in the presence of particle number superselection rules, the security of one-way BC is rigorously 
unchanged, see Section |5] 

V|xo,i) sucnthatAr lxo,i) = n|xo,i), 

G max (BC N (\ X o,i») = G max (BC(| X o,i») = G max (AFBC(| xo,i»), 
C max (BC^(| X0 ,i») = C max (BC(| xo,i») = C max (AFBC(| X o,i))). (6) 

However, in the presence of angular momentum superselection rules (operator J 2 ; a 'nonabelian' case), 
a one-way BC with arbitrarily high security can be devised if we force the scheme to be ancilla-free 

3 | Xo,i(j)), such that J 2 | xo,i(j)) = j(j + 1)1 Xo,i), 
G max (AFBC j2 (|xo,i(j))))=0, 

C max (AFBC j2 (| Xo,i(j)») - fori - oo. (7) 

We do not have a rigorous proof of the statement about the asymptotic behavior of (7 max ( AFBC j2 ( | xo, l ) ) ) > 
but we conjecture a formula for the fidelity function which coincides with numerical data up to j = 11, and 
which implies the asymptotic security just stated; see Section |6] 

2 In fact the security of both our schemes does not change if we permit Alice to create any state x- 
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5 Particle Conservation 

We now prove Eq. @. In Ref. [6| Mayers first proved the simplest case in which the fact that the protocol 
is completely sealing makes it completely unbinding, i.e. Alice can always change her commitment. The 
arguments here are a straightforward extension of this simple case. The number operator is additive over 
tensor product Hilbert spaces, so we can write 

N = N t + N p . (8) 

This means that if, as we assume, N\ Xo,i) = n \ Xo,i)> then these states must have the form 

n 

\Xb) = ^2 c b(it,ip,m)\i p ,n-m) p \i t ,m} t , (9) 

it,ip,m=0 

that is, if the token system has m particles, the proof system must have n — m particles. The labels i p and 
it denote other quantum numbers characterizing the states. It is understood that the range of the it and i p 
sums can depend on m (i.e., they depend on the local particle number). 

The security parameters defined above depend only on the reduced density operators on the token sub- 
system of the two states. For the states of the form of Eq. (|9j, these can be written as 

n n 

Pb= ^ ^ c b(k,ip,m)c* b (jt,i p ,rn)\it,m)(j t ,m\ = (J) Pb, m ^b,m, (10) 

H,jt,m=0 i p m=0 

where p^ m is the probability of each m, and a^ m is a normalized density operator in each m sector: 
tr<7k iTra = 1. 

Consider what happens if Bob cheats. The ideal optimal measurement for Bob that he can do to achieve 
Eq. © is a complete von Neumann measurement in the eigenbasis of p — p\. But, because of Eq. ( fTUl . this 
eigenbasis is also an eigenbasis of the particle number of the token system and given the superselection rule, 
Bob is allowed to do this optimal measurement. So, Bob can gain exactly the same amount of information 
in the protocol constrained by superselection rules, G max (BC./v(l Xo,l))) = G max (BC(| Xo,i)))- 

Next, we consider what happens if Alice cheats. We will show that 

C max (BCAr(| xo,i» = C max (BC(| xo,i))- First of alL due to the block-diagonal character of p and 
pi we can write 

C maX (BC(|xO,l» = -tr|VWPll = g Yl VP0,mPl,mF(&0,m,&l,m). (H) 

m=Q 

On the other hand, Uhlmann's theorem for the fidelity function F is also written as: 

F(p ,pi) = max|(xo|^p®-f*|Xi)l = maxK((xo \U P ® I t \ Xl))- ( 12 ) 

Up Up 

We arrive at this last form by recognizing that U p can have any arbitrary global phase. In Ref. [V | it is shown 
that C = \ (xo \ U p <g) It | Xl) 1/2 can be achieved if Alice creates the 6-independent state 

I X) oc (| xo> + e-* ar §(^ I W*l »»| xi)) (13) 

prior to the commit phase. If she decides during the commit phase that 6 = 0, she leaves that state unchanged 
and sends it to Bob; if she wants 6=1, she applies the optimal U p of Eq. (fT2t to the proof system that she 
still holds. 
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But in the presence of the charge superselection rule, it is not possible to do the unconstrained max- 
imization of Eq. (fT2"l) : we must respect constraints 2. and 3. above imposed by the superselection rules, 
which require that U p be block diagonal in the charge index. We observe that Alice can create the cheating 
state x °f Eq. (1131 while respecting the superselection rule. Thus we can write (7 max in this case as a 
constrained maximization: 

C ,max (BC JV (|xo,i))) = ^ max »(( Xo \U P ® h\ Xi}) (14) 
In order to evaluate this expression, we rewrite the states of Eq. (|9|i as 

n 

I X6> = X) V^."»|X6,m)- (15) 
m=0 

Putting (fT3l into ( flU l and working out the expression gives 

1 n 

C max (BC^(| Xo,l») = 2 E VPo,mPi, m F(a , m , a 1>m ). (16) 

m=0 

In other words, we obtain the claimed equality C max (BCAr(| xo,l)) = C max (BC(| Xo,i))- 

We will now find a very different situation for angular-momentum conservation. The idea is to find two 
states Xb f° r b = 0, 1 such that the local density matrices for Bob, pf,, look the same given the superselection 
rule. This implies that the diagonal elements of p^ in the local definite angular momentum basis must be the 
same. The off-diagonal elements can be different however, and we can try to adjust these free parameters 
so as to limit Alice's cheating strategies. In the case of particle conservation there is no room to adjust free 
parameters since the off-diagonal elements of p^ in the number basis are always zero, see Eq. (flOl . This is 
the essential difference between the abelian and the non-abelian case. 



6 Angular Momentum Conservation 

We introduce a family of one-way bit commitment protocols, one for each total angular momentum quan- 
tum number j (2j € Z + ), although we will only discuss the integer case in detail). Alice's two states xo,i 
are states with total angular momentum j to t = j and m to t = j- We denote the Clebsch-Gordan coefficients 
as C(Ja, rriA, jB,rriB, jtot,rntot) where jA, rriA are the quantum numbers of the 'proof spin (kept by Al- 
ice, initially) and jb^b are the quantum numbers of the 'token' spin (sent to Bob). Unlike the number 
operator, total angular momentum is not an additive quantity (herein lies the crucial difference between 
the security of the two cases), i.e. the two local angular momenta Ja and jg can give rise to total angular 
momentum between \ja — 3b\ and ja + Jb- We take states for fixed j to be 

2j j 

Xo(j) = X) "v^b X C (0,rriA,jB,j -m A ,j,j)\j,m A )p\jB,j -m A )t, (17) 

j B =0 m A =-j 
2j j 

Xl 0') = X ( _1 ) JS "v / ^s X C (ji m AdB,j-rn A ,j,j)\j,m A ) p \jB,j-m A ) t . (18) 

j B =0 m A =-j 

Of course, the z-component of the local spin cannot be larger than the total local spin; we impose this in 
the above equations by taking the the Clebsch-Gordan coefficients C(j, m A ,jB,j — m A , j, j) to be zero if 
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j — m A > 3b- The /3-coefficients obey the following constraints: 

E = !> (19) 

3B=0 

E (-iy B p jB = o, (20) 

Vis, > 0. (21) 

The first equation enforces the normalization and the second equation enforces the orthogonality of xo an d 
Xi- Before considering Alice's strategies, which will give us additional equations for the /3-coefficients, let 
us consider Bob's cheating strategies. Due to the superselection rule his measurement has to be diagonal in 
the total angular momentum of his particle which implies that he will not be able to detect any difference 
in the terms of po and p\ that are off-diagonal in the j^-basis. The states Xb{j) w& chosen such that the 
on-diagonal terms of p and p\ are identical. This implies that for all j, G max (AFBCj2(| Xo,i))) = 0. 

In order to analyze Alice's cheating ability, we work out the expression for the fidelity F in Eq. (|5} which 
provides an upper bound on her cheating strategies. Note that the expressions for \b have the Schmidt form: 

I Xb) = E V X rn A \ j,m A }\ 4>™ A ), (22) 
m A 

where 4>™ A are normalized orthogonal vectors: 

2.7 



== ^(-l) b ' 3B v^C(j,m A ,jB,j -rn A ,j,j)\j B ,j -m A ). (23) 



The Schmidt coefficients in Eq. d2~2l are independent of the bit b: 

Xm A = J }2l3j B C 2 (j,m A ,j B ,j - m A ,j,j). (24) 

is 

Also note that for these states 

A 

where 

2j 

Km A = E (-l) is /5i B C 2 (j,m A , j B ,j - m A ,j,j). (26) 
is=o 

With these tools, Uhlmann's fidelity can be written as 



{(/)™ A | cj)'[ lA ) = -^—K mA 5 mAm , , (25) 

x m A 



F (P0,Pl) = K\J y/P0Pl\fp~0 = E \ K "i A \ = E S ^A K rn A , (27) 

m A m A 

where s mA = sign(K mA ) and thus 

j 2j 

F= E s ™a E {-l) jB P jB C 2 ti,m A ,j B ,j - m A ,j,j). (28) 

m A =-j js=0 
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We arrive at a piecewise linear program: determine the vector which minimizes F under the constraints 
given by Eq. JTil. For completeness, let us state the Clebsch-Gordan coefficients as they appear in the 
expression for K mA : 

/-m A +j+j B \ I m A +j \ 

C 2 {j,m A ,j B J-m A ,j,j) = ~ mA ti + !j^ » 0<3B< 2j, 1 < m A < j, m A > j - j B , 

\ 2j+l ) 

C 2 {j, m A ,j B ,j - m A , j, j) = 0, < j B < 2j, 1 < m A < j, m A < j - j B . (29) 
(That is, a binomial coeficient outside its usual range should be taken to be zero.) 

6.1 Numerical Analysis 

For each integer j we have investigated this piecewise linear program numerically. (We do not report the 
half-integer j results here, they work out similarly). We have done the minimization up to j = 11 and we 
observe the following patterns. As it turns out, in all solutions we find that j3k = for j + 2 < k < 2j. 
Secondly, in every case, the terms in Eq. d2"%t for m A > are identically zero. This gives us a set of linear 
equalities for (3j B : 

2j 

\/m A : l<m A <j, ^ (-l) 33 f3 jB C 2 (j,m A , j B , j - m A , j, j) = 0. (30) 
is=o 

Thirdly, in alternating cases (j even or j odd), we find that s_i and sq are {+1, —1} and {— 1,+1}. In 
addition, the remaining terms in Eq. (I28t . for m A < —1, are also identically zero. For example, the 
solutions for j = 1, 2, 3 are 

• j = 1: A), 1,2 = {§, ^, leading to the sign assignments s_i ; o,i = {+1, — l,x} where x implies 
that si is irrelevant in the minimization. This leads to F = |. 

• j = 2: A),i,2,3,4 = {^,^,^,^j,0}, leading to the sign assignments s_2 -1,0,1,2 = {x,-l,+l,x,x}. 
For these /3 values, F = 

• j = 3: A),i,2,3,4,5,6 = {^5, f , jj, ^,0,0}, leading to the sign assignments 
s-3,-2,-1,0,1,2,3 = {x, x, +1, -1, , x, x, x}. For these (3 values, F = 

Most importantly, we have observed that for all cases up to j = 11, we find optimal values of F that 
agree with the simple formula: 

" '23 + r 
i + i 



(3D 



As is clear from this formula, which we conjecture to correspond to a feasible solution for the /3-vector for 
all j, F goes to zero exponentially fast as j —> 00 which implies the security of the protocol. 
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